Right now invoke deploy deploys whatever current version is checked out. This means that unless one is careful it's easy to deploy the master branch by mistake instead of the tagged version. Moreover, it should be disallowed to deploy a version that is not properly tagged.
invoke deploy should be rewritten to require a tag argument. The code should then checkout that tag, deploy it, and revert to HEAD.